Key Takeaways
- C# receive Android SMS gateway API webhooks: a public HTTPS URL, raw-body HMAC, and an event-id unique constraint — not a NuGet “C SDK” or Complete C# SDK.
- Ack 2xx quickly. Retries of the same event must not send another SMS.
- Confirm header names in Developer Center. Samples below are illustrative.
- /codebase-csharp is REST HTTPS/JSON examples, not a packaged product.
- Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Free is 300 SMS lifetime.
- ISO C would use the same POST; we do not ship a libsmsgateway.a.
Catalog title: receive Android SMS gateway API webhooks in C#. Hub: Android SMS gateway API. REST samples: C# HTTPS/JSON samples. Depth: server webhook in-depth. This page is the receive path, not a SDK download.
Priced by devices and SMS send volume. You use your own phone and operator SMS credit.
If you needed a vendor C library to parse JSON over TLS, you did not need a gateway. You needed a HTTP client you already have.
Your process is the subscriber
Register a URL the control plane can reach. The Android radio does not punch a hole in your VPC. Cloud relay POSTs; you verify and persist. Product: webhooks.
HTTPS JSON — not a C SDK
Language does not matter: C, C#, PHP. The contract is Bearer send elsewhere and signed POSTs here. We do not ship libcurl wrappers as a product. PHP sibling samples: PHP HTTPS/JSON.
Event table: delivered, failed, received
| type (illustrative) | Your job | Do not |
|---|---|---|
| message.delivered | Mark DLR on the outbox row | Treat as login success without your expiry rules |
| message.failed | Surface to support; maybe retry send with a new idempotency key | Retry inside the webhook without a new business event |
| message.received | STOP / inbox write | Ignore because the template had a footer |
Live names: Developer Center. Illustrative delivered body:
{
"id": "evt_01K2F8QW3N4RXB7M",
"type": "message.delivered",
"createdAt": "2026-08-12T14:04:09Z",
"apiVersion": "2026-08-12",
"data": {
"message": {
"id": 41823,
"number": "+14155552671",
"text": "Your verification code is 481920",
"status": "Delivered",
"campaignId": 17,
"deviceId": 3,
"metadata": { "orderId": "1234" },
"sentAt": "2026-08-12T14:04:02Z",
"deliveredAt": "2026-08-12T14:04:09Z"
}
}
}HMAC over the raw body
ASP.NET: disable buffer that rewrites JSON before the hash. Compare with a fixed-time equals. Dedupe X-SmsGateway-Event-Id as documented. RFC background: RFC 2104. Limits: webhooks limits.
C# / ASP.NET pattern
Map a POST endpoint, read EnableBuffering / raw stream, verify, return 200 after enqueue. Hangfire workers belong on send, not inside the HMAC handler. Queue workers. Keys in env: secure API keys.
ISO C is still just HTTP
A C process can listen with your existing TLS stack and parse JSON. That is not an official C SDK, NuGet, or “Download C SDK” button. Same rules: raw body, secret in env, no keys in firmware.
Callbacks are not airtime
Priced by devices and SMS send volume. You use your own phone and operator SMS credit. Dropped webhooks do not refund the SIM. Retry storms that re-POST send will.
Checklist
- Public HTTPS URL.
- Raw-body HMAC.
- Event-id unique index.
- 2xx after enqueue, not after a 3s DB chain.
- Secret in env.
- No SDK branding in your README.
- STOP writes suppression.
- Developer Center checked this week.
- Staff canary: one inbound, one DLR.
- No unlimited SMS story about event volume.
Next steps
Read C# samples and Developer Center. Receive is HTTP. Send is still a phone you fund.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- SMS webhook integrationInbound and status events
- SMS API documentationLive endpoint reference
- C# REST send samplesC# code examples
- device and SMS volume pricingPlans and allowances
